nixos-config/config/profile-config/host/ssh.nix

{ config, lib, pkgs, ... }:

with lib;
let
  hostname = config.instance.hostname;
  has-attrs = set: length (attrNames set) > 0;
  read-lines = filename: splitString "\n" (fileContents filename);
  has-secret-files = hasAttr "files" config.fudo.secrets;

in {
  config = mkIf has-secret-files (let
    host-keypairs =
      if (hasAttr hostname config.fudo.secrets.files.ssh.host-keypairs) then
        config.fudo.secrets.files.ssh.host-keypairs.${hostname}
      else
        [ ];

  in {
    fudo = let
      sshfp-filename = host: keypair:
        "ssh-${host}-${keypair.key-type}.sshfp-record";

      dns-sshfp-records = host: keypair:
        pkgs.stdenv.mkDerivation {
          name = "${host}-sshfp-records";

          phases = [ "installPhase" ];

          buildInputs = with pkgs; [ openssh ];

          installPhase = ''
            ssh-keygen -r REMOVEME -f "${keypair.public-key}" | sed 's/^REMOVEME IN SSHFP //' > $out'';
        };

      host-cfg = config.fudo.hosts.${hostname};
    in {
      secrets.host-secrets.${hostname} = listToAttrs (map (keypair:
        nameValuePair "host-${keypair.key-type}-private-key" {
          source-file = keypair.private-key;
          target-file =
            "/run/openssh/private/host-${keypair.key-type}-private-key";
          user = "root";
        }) host-keypairs);

      hosts = mkIf (hasAttr "files" config.fudo.secrets) (mapAttrs
        (hostname: keypairs: {
          ssh-pubkeys = map (keypair: keypair.public-key) keypairs;
          ssh-fingerprints = concatMap (keypair:
            let fingerprint-derivation = dns-sshfp-records hostname keypair;
            in read-lines "${fingerprint-derivation}") keypairs;
        }) config.fudo.secrets.files.ssh.host-keypairs);
    };

    services.openssh.hostKeys =
      let host-secrets = config.fudo.secrets.host-secrets."${hostname}";
      in map (keypair: {
        path = host-secrets."host-${keypair.key-type}-private-key".target-file;
        type = keypair.key-type;
      }) host-keypairs;
  });
}